Welcome to Codidact Meta!

Codidact Meta is the "town hall" (meta-discussion site) for the Codidact community network and the Codidact software. Whether you have bug reports or feature requests, support questions or rule discussions that touch the whole network – this is the site for you.

Comments on Support FIDO2 1/2FA.

Post

Support FIDO2 1/2FA.

−0

It provides significantly quicker authentication processes, and significantly less chance of phishing, since the user cannot be convinced to enter a credential (although TOTP mostly solves that, too).

Examples

Discourse, Forgejo, KeyCloak, Mastodon and Addy support it. GitLab and Matruix's Synapse are tracking their implementation of it.

Repostage

Implementation is tracked at github.com/codidact/qpixel/issues/1836.

feature-request

posted about 1 year ago

CC BY-SA 4.0

1y ago

Mr. Beedell, Roke Julian Lockhart (RJLB)‭

17 8 46 44

Raw

Markdown

History

2 comment threads

Multiple keys (4 comments)

Good idea (1 comment)

Michael‭ wrote 12 months ago · edited 12 months ago

copy link

Close, but with FIDO2, not TOTP. With TOTP, you are making a six-digit rotating password "1/N as safe" for each device. It can drop into brute-force territory with a handful of devices. That's not equivalent to FIDO2, which has substantially longer challenge/response keys.

AWS for a while only permitted one FIDO2 device, so unless you had YubiKeys that were special-ordered to have the same IV... if you lost it, you were completely locked out. FIDO2 almost needs to have the ability to register multiple devices with an identifier.